Publisher - Reverse Engineering

Post Five - 10 June 2007

Okay, so here's a new strategy - let's go really simplistic:

• Start MS Publisher
• Create Empty Document
• File/Save, foo.pub
• File/Exit.
• copy foo.pub foo1.pub
• Start MS Publisher
• Create Empty Document
• File/Save, foo.pub (one difference: Confirm overwrite)
• File/Exit.

By "Create Empty Document", I mean the following explicit steps:

• Single-Click on "Blank Page Sizes"
• Double-Click on "A4 (Portrait)"

Raw list of files

These two files should be identical, right? Well, no. One is saved as LOCALS~1\Temp\pub1.tmp, the other is pub4.tmp. Also, this keeps occurring:

1380	2544	0	0		224	e0
1381	2545	234	ea		211	d3
1382	2546	13	d		3	3
1383	2547	74	4a	'J'	88	58	'X'
1384	2550	239	ef		239	ef
1385	2551	170	aa		170	aa
1386	2552	199	c7		199	c7
1387	2553	1	1		1	1
1388	2554	0	0		224	e0
1389	2555	91	5b	'['	211	d3
1390	2556	16	10		3	3
1391	2557	74	4a	'J'	88	58	'X'
1392	2560	239	ef		239	ef
1393	2561	170	aa		170	aa
1394	2562	199	c7		199	c7
1395	2563	1	1		1	1

At bytes 1252, 1380, 1508, 1636 (all 128 bytes apart), then again at 58468. And this:

60298

165612

182

b6

183

b7

- which we see at 60298, 30328 (+30), 60768 (+440), 60850 (+82).

So we can't even create the same (blank) file, without introducing differences. Still, 49 bytes is - far and away - the smallest diff I've seen between two publisher files to date.